SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-03-22 18:59:07 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

blocking-nameserver: Init

Browse source
This commit is contained in:
SebastianStork 2026-03-17 17:59:52 +01:00
parent cd95e0dce3
commit 2cdfec2086
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
2 changed files with 106 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

38
modules/nixos/services/nameservers/recursive.nix
View file

@ -1,7 +1,5 @@
{
config,
inputs,
pkgs,
lib,
allHosts,
...
@ -10,27 +8,21 @@ let
cfg = config.custom.services.recursive-nameserver;
netCfg = config.custom.networking;
blocklist =
pkgs.runCommand "blocklist.conf" { } ''
echo "server:" > $out
cat ${inputs.blocklist}/hosts \
| grep '^0.0.0.0 ' \
| awk '$2 != "0.0.0.0" {print " local-zone: \"" $2 "\" refuse"}' \
>> $out
''
|> toString;
privateNameservers =
allHosts
|> lib.attrValues
|> lib.filter (host: host.config.custom.services.private-nameserver.enable);
|> lib.filter (host: host.config.custom.services.private-nameserver.enable)
|> lib.map (
host:
"${host.config.custom.networking.overlay.address}@${toString host.config.custom.services.private-nameserver.port}"
);
in
{
options.custom.services.recursive-nameserver = {
enable = lib.mkEnableOption "";
port = lib.mkOption {
type = lib.types.port;
default = 53;
default = 5336;
};
blockAds = lib.mkEnableOption "";
};
@ -41,13 +33,10 @@ in
services = {
unbound = {
enable = true;
settings = {
server = {
interface = [ "${netCfg.overlay.address}@${toString cfg.port}" ];
access-control = [ "${toString netCfg.overlay.networkCidr} allow" ];
prefetch = true;
};
include-toplevel = lib.mkIf cfg.blockAds blocklist;
settings.server = {
interface = [ "${netCfg.overlay.address}@${toString cfg.port}" ];
access-control = [ "${toString netCfg.overlay.networkCidr} allow" ];
prefetch = true;
};
};
@ -73,12 +62,7 @@ in
stub-zone = lib.singleton {
name = netCfg.overlay.domain;
stub-addr =
privateNameservers
|> lib.map (
host:
"${host.config.custom.networking.overlay.address}@${toString host.config.custom.services.private-nameserver.port}"
);
stub-addr = privateNameservers;
};
};
})